You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
There is a current investigation on the behaviour of the Secret Service API, as other applications can easily read any secret, if the keyring is unlocked (if a user is logged in, then the login/default collection is unlocked). Available D-Bus protection mechanisms (involving the busconfig and policy XML elements) are not used by default. The Secret Service API was never designed with a secure retrival mechanism.
34
+
On GNOME, after the key ring is unlocked, all applications of the current user can access the passwords.
35
+
According to [Debian's evaluation](https://security-tracker.debian.org/tracker/CVE-2018-19358), this is a non-issue.
36
+
Workaround: Users can use separate key rings.
34
37
35
-
*CVE-2018-19358 Base Score: __[7.8 HIGH]__, CVSS:3.0
36
-
* GNOME Keyring Secret Service API Login Credentials Retrieval Vulnerability Base Score: __[5.5 Medium]__, CVSS:3.0
38
+
Please keep in mind the above is not only about GNOME. Windows credentials [can be recovered easily](https://security.stackexchange.com/a/63909/37275).
37
39
38
-
## Public Service Announcement ##
40
+
Both Mac OS X and Windows will ask the runtime to allow the __Java runtime__ to connect to the key ring. This is an issue in case applications share the Java runtime: All of these applications can access the passwords stored in the key ring. This should be considered a vulnerability, as all java apps will be allowed access. I personally wouldn't store any credentials in the system keyring, ever, and especially on a system allowing any java application access.
39
41
40
-
Please keep in mind the above isn't only about gnome/secret service. Both os-x and window will ask the runtime to allow __java__to connect to the key ring. This should be considered a vunlrability, as all java apps will be allowed access. I personally wouldn't store any credentials in the system keyring, ever, and especially on a system allowing any java app access.
42
+
That said, I would be comfortable storing in plain text. For example, passwords you may be forced to store in `~/.m2/settings.xml` are development databases credentials, etc.). For any of the things a developer usually has to store in plain text because there is no better option would be fine to store in the key ring. At least you can look them up in all your tests/apps in a single location if you are consistent with your service/user naming. Hopefully, these developing services are not available to the internet, you VPN into them, right? They may have attack vectors as well. [strongSwan](https://www.strongswan.org/) is pretty easy to set up.
41
43
42
-
That said, anything I would be comfortable storing in plain text would be fine. For example, passwords you may be forced to store in ~/.m2/settings.xml, developement databases creds, etc) or any of the things a developer usually has to store in plain text because there is no better option would be fine to store in the keyring. At least you can look them up in all your tests/apps in a single location if you are consistent with your service/user naming. Hopefully these dev services are not available to the internet, you vpn in to them, right? They may have attack vectors as well. StrongSwan is pretty easy to set up.
44
+
Use a real password manager for your real secrets. Something like [KeePassXC](https://keepassxc.org/), [Bitwarden](https://bitwarden.com/), Enpass, 1Password, etc. Keep that password manager locked - make sure it is setup to autolock after you login to something with it. Use a secondary factor if you can with important services, particularly financial, and e-mail, and if you're in to that sort of thing, social sites - like github.com.
43
45
44
-
Use a real password manager for your real secrets. Something like Keypass, Enpass, 1Password, Bitwarden, etc. Keep that password manager locked - make sure it's setup to autolock after you login to something with it. Use a secondary factor if you can with important services, particularly financial, and e-mail, and if you're in to that sort of thing, social sites - like github.com.
46
+
## Implementation
45
47
46
-
##Implementation ##
48
+
### Mac OS X
47
49
48
-
__Mac OS X__
49
-
* Passwords are stored using [OS X Keychain](https://support.apple.com/guide/keychain-access/welcome/mac) using [Keychain Services](https://developer.apple.com/documentation/security/keychain_services/keychain_items). This is done either via built-in JNA bindings for the legacy API, or [jkeychain](https://github.com/davidafsilva/jkeychain).
50
+
* Passwords are stored using [OS X Keychain](https://support.apple.com/guide/keychain-access/welcome/mac) using [Keychain Services](https://developer.apple.com/documentation/security/keychain_services/keychain_items). This is done either via built-in [JNA](https://github.com/twall/jna) bindings for the legacy API, or [jkeychain](https://github.com/davidafsilva/jkeychain).
50
51
51
-
__Linux/Freedesktop__
52
-
* Passwords are stored using either [DBus Secret Service](https://specifications.freedesktop.org/secret-service/) (you've probably used [Seahorse](https://en.wikipedia.org/wiki/Seahorse_(software))) via the excellent [secret-service](https://github.com/swiesend/secret-service) library, or KWallet under KDE.
52
+
### Linux/Freedesktop
53
+
54
+
* Passwords are stored using either [DBus Secret Service](https://specifications.freedesktop.org/secret-service/) (you've probably used [Seahorse](https://en.wikipedia.org/wiki/Seahorse_(software))) via the excellent [secret-service](https://github.com/swiesend/secret-service) library, or [KWallet](https://apps.kde.org/de/kwalletmanager5/) under KDE.
55
+
56
+
### Windows
57
+
58
+
* Passwords are stored using [Credential Manager](https://support.microsoft.com/en-us/help/4026814/windows-accessing-credential-manager), exceptions will contain [Error Codes](https://docs.microsoft.com/en-us/windows/win32/debug/system-error-codes). Access is via the [Wincred](https://docs.microsoft.com/en-us/windows/win32/api/wincred/) API.
59
+
* Windows seems prone to race conditions where reads/writes may not be immediately visible.
53
60
54
-
__Windows__
55
-
* Passwords are stored using [Credential Manager](https://support.microsoft.com/en-us/help/4026814/windows-accessing-credential-manager), exceptions will contain [Error Codes](https://docs.microsoft.com/en-us/windows/win32/debug/system-error-codes). Access is via the [Wincred](https://docs.microsoft.com/en-us/windows/win32/api/wincred/) api.
56
-
Windows seems prone to race conditions where reads/writes may not be immediately visible.
61
+
## Usage
57
62
58
-
## Usage ##
63
+
The library is available at Maven central: <https://central.sonatype.com/artifact/com.github.javakeyring/java-keyring>.
59
64
60
-
Dirt simple:
65
+
The most simple usage is as follows:
61
66
62
67
```java
63
68
try (Keyring keyring =Keyring.create()) {
@@ -67,7 +72,7 @@ Dirt simple:
67
72
}
68
73
```
69
74
70
-
Recommend creating a dummy value if getPassword() fails, so that users know where to go set the value in their applications.
75
+
Recommend creating a dummy value if `getPassword()` fails, so that users know where to go set the value in their applications.
71
76
72
77
```java
73
78
try (finalKeyring keyring =Keyring.create()) {
@@ -85,36 +90,33 @@ Recommend creating a dummy value if getPassword() fails, so that users know wher
85
90
}
86
91
```
87
92
88
-
## Building ##
93
+
## Building
89
94
90
95
```bash
91
96
mvn clean install -Dgpg.skip=true
92
97
```
93
98
94
-
## License ##
99
+
## License
95
100
96
-
Source code of java-keyring is available under a BSD license.
97
-
See the file LICENSE.EAST301 for more details.
101
+
Source code of java-keyring is available under a BSD license.
102
+
See the file [`LICENSE`](LICENSE) for more details.
98
103
99
-
## PRs are Welcome ##
104
+
## PRs are Welcome
100
105
101
106
Outstanding work:
102
107
103
-
* Windows error message conversion.
104
-
* Windows has no locking/session mechanism allowing for races between threads (like the maven tests in this project).
105
-
* Provide easy binding for Spring / CDI / etc.
106
-
* Support for build tools like Maven/Gradle.
107
-
* Perhaps optional UI requests for passwords (Wincred/secret-service have Apis at least to prompt users).
108
-
* Convert to Kotlin and test in different Kotlin build target (node/jvm/binary).
108
+
* Windows error message conversion.
109
+
* Windows has no locking/session mechanism allowing for races between threads (like the maven tests in this project).
110
+
* Provide easy binding for Spring / CDI / etc.
111
+
* Perhaps optional UI requests for passwords (Wincred/secret-service have APIs at least to prompt users).
112
+
* Convert to Kotlin and test in different Kotlin build target (node/jvm/binary).
109
113
110
114
That said, this library is perfectly usable today and tested on all systems. Checkout the badges above!
111
115
112
-
## Special Thanks ##
116
+
## Special Thanks
113
117
114
-
java-keyring uses the following library, thanks a lot!
115
-
java-keyring package contains copy of compiled JNA library.
116
-
Source code of the library is available at its project page.
118
+
java-keyring uses the following libraries, thanks a lot!
0 commit comments